drm/panfrost: Make sure a BO is only unmapped when appropriate

mmu_ops->unmap() will fail when called on a BO that has not been
previously mapped, and the error path in panfrost_ioctl_create_bo()
can call drm_gem_object_put_unlocked() (which in turn calls
panfrost_mmu_unmap()) on a BO that has not been mapped yet.

Keep track of the mapped/unmapped state to avoid such issues.

Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190618081343.16927-1-boris.brezillon@collabora.com

diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.c b/drivers/gpu/drm/panfrost/panfrost_gem.c
index a5528a360ef4f9ccef03dd5ebe6365594d59fd01..97d64ceedbb4cf6ca75d47426b0121cf5b3ca7f0 100644 (file)
--- a/drivers/gpu/drm/panfrost/panfrost_gem.c
+++ b/drivers/gpu/drm/panfrost/panfrost_gem.c
@@ -19,7 +19,8 @@ static void panfrost_gem_free_object(struct drm_gem_object *obj)
        struct panfrost_gem_object *bo = to_panfrost_bo(obj);
        struct panfrost_device *pfdev = obj->dev->dev_private;
 
-       panfrost_mmu_unmap(bo);
+       if (bo->is_mapped)
+               panfrost_mmu_unmap(bo);
 
        spin_lock(&pfdev->mm_lock);
        drm_mm_remove_node(&bo->node);

diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.h b/drivers/gpu/drm/panfrost/panfrost_gem.h
index 045000eb5fcfde98830e0aba9116ec81ebebf0d6..6dbcaba020fcbe0217e4b00350026b88ded22cee 100644 (file)
--- a/drivers/gpu/drm/panfrost/panfrost_gem.h
+++ b/drivers/gpu/drm/panfrost/panfrost_gem.h
@@ -11,6 +11,7 @@ struct panfrost_gem_object {
        struct drm_gem_shmem_object base;
 
        struct drm_mm_node node;
+       bool is_mapped;
 };
 
 static inline

diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c
index 762b1bd2a8c22afb37bf73c743c3b76d7d4f42ee..92ac995dd9c66be77484f5f634d463098607f91a 100644 (file)
--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -156,6 +156,9 @@ int panfrost_mmu_map(struct panfrost_gem_object *bo)
        struct sg_table *sgt;
        int ret;
 
+       if (WARN_ON(bo->is_mapped))
+               return 0;
+
        sgt = drm_gem_shmem_get_pages_sgt(obj);
        if (WARN_ON(IS_ERR(sgt)))
                return PTR_ERR(sgt);
@@ -189,6 +192,7 @@ int panfrost_mmu_map(struct panfrost_gem_object *bo)
 
        pm_runtime_mark_last_busy(pfdev->dev);
        pm_runtime_put_autosuspend(pfdev->dev);
+       bo->is_mapped = true;
 
        return 0;
 }
@@ -203,6 +207,9 @@ void panfrost_mmu_unmap(struct panfrost_gem_object *bo)
        size_t unmapped_len = 0;
        int ret;
 
+       if (WARN_ON(!bo->is_mapped))
+               return;
+
        dev_dbg(pfdev->dev, "unmap: iova=%llx, len=%zx", iova, len);
 
        ret = pm_runtime_get_sync(pfdev->dev);
@@ -230,6 +237,7 @@ void panfrost_mmu_unmap(struct panfrost_gem_object *bo)
 
        pm_runtime_mark_last_busy(pfdev->dev);
        pm_runtime_put_autosuspend(pfdev->dev);
+       bo->is_mapped = false;
 }
 
 static void mmu_tlb_inv_context_s1(void *cookie)